CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

auditing-part11-trails

Generates and verifies 21 CFR Part 11-style audit trails — who/what/when, electronic signatures, and tamper-evidence — for OpenMed pipelines in GxP and clinical-trial (GCP) settings. Use when the user runs OpenMed in a regulated/validated environment and needs an attributable, time-stamped, tamper-evident record of each processing action, electronic-signature manifestations, or computer-system-validation (CSV) evidence. Trigger keywords: 21 CFR Part 11, Part 11, audit trail, electronic signature, e-signature, GxP, GCP, GLP, GMP, CSV, computer system validation, data integrity, ALCOA, tamper-evident, contemporaneous. Pairs adjacent to OpenMed: maps directly onto OpenMed deidentify(audit=True) -> signed AuditReport with .sign(key)/.verify(key), whose repro_hash + HMAC give the tamper-evidence and attribution Part 11 expects. This is a compliance-enablement aid, not a validation certification.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is strong: executable quick-start code, a concrete 7-step workflow with verification, and useful edge-case gotchas, all in a well-organized self-contained file. The only weaknesses are a duplicated compliance caveat and the absence of an explicit error-recovery path when verification fails.

Suggestions

State the 'compliance-enablement, not certification' caveat once (keep it in Edge cases) and drop the duplicated paragraph in the intro, and trim the ALCOA+ acronym expansion Claude already knows.

Add a short recovery step after verification: when .verify() fails or the assert triggers, say what to do (e.g., quarantine the trail, re-derive from source inputs, and escalate to the QA owner) so the workflow has an explicit feedback loop.

Tighten the intro to two or three sentences by letting the Part 11 mapping table carry the regulatory detail, reducing token cost without losing the who/when/what framing.

DimensionReasoningScore

Conciseness

The body is efficient and code-forward, but the compliance-enablement caveat is stated twice (intro paragraph and the "Part 11 ≠ one library" edge case) and the ALCOA+ expansion is background Claude largely knows. Matches the 4 anchor (minor over-explanation that could be trimmed) rather than the 5 anchor where every token earns its place.

4 / 5

Actionability

The Quick start is fully executable copy-paste Python covering the common cases (deidentify with audit=True, .sign with key_id, Part 11 envelope, later .verify with assert), and the workflow names concrete operations (.sign(), vault/HSM keys, WORM storage). Matches the 5 anchor.

5 / 5

Workflow Clarity

The 7-step workflow is clearly sequenced with an explicit verification checkpoint (step 6 "Verify on retrieval" plus the assert in Quick start), so the validation cap at 3 does not apply. However there is no error-recovery loop explaining what to do when .verify() fails, which keeps it at the 4 anchor rather than the 5 anchor requiring feedback loops.

4 / 5

Progressive Disclosure

The skill is self-contained with no bundle files, and the body is a well-organized overview: labeled sections (When to use, mapping table, Quick start, Workflow, Hand-off, Edge cases, Standards & references) with nothing inlined that belongs in a separate file and a one-level external reference list. Easy to navigate.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it states concrete capabilities, an explicit and specific use-when clause, a comprehensive natural-keyword list with synonyms, and a well-scoped niche with boundary disambiguation. Every clause is functional with essentially no padding.

DimensionReasoningScore

Specificity

"Generates and verifies 21 CFR Part 11-style audit trails — who/what/when, electronic signatures, and tamper-evidence" lists multiple concrete capabilities (generate, verify, e-signature manifestation, tamper-evidence) with comprehensive coverage for the domain. Matches the 5 anchor; there are no coverage gaps that would justify 4.

5 / 5

Completeness

Explicitly answers both what ("Generates and verifies 21 CFR Part 11-style audit trails…") and when ("Use when the user runs OpenMed in a regulated/validated environment and needs…") with concrete trigger phrases. This is the 5 anchor verbatim in structure.

5 / 5

Trigger Term Quality

The explicit keyword list ("21 CFR Part 11, Part 11, audit trail, electronic signature, e-signature, GxP, GCP, GLP, GMP, CSV, computer system validation, data integrity, ALCOA, tamper-evident, contemporaneous") covers natural terms plus synonyms and acronym/full-name variants, exactly the synonym coverage the 5 anchor requires.

5 / 5

Distinctiveness Conflict Risk

A clear niche (Part 11 audit trails for OpenMed pipelines in GxP settings) with distinct regulatory trigger vocabulary, and it explicitly disambiguates from adjacent skills ("Pairs adjacent to OpenMed: maps directly onto OpenMed deidentify(audit=True)…"). Minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

maziyarpanahi/openmed

Path

skills/auditing-part11-trails/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.